IVote refresh project for the 2019 NSW State election - February 2019
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
iVote refresh ® project for the 2019 NSW State election Published at Commission | GPO Box 4046 Sydney NSW 2001 NSW Electoral T 1300 022 2019 February 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 1 of 92
iVote® refresh project for the 2019 NSW State election 1 Summary 5 2 Introduction 6 2.1 Background 6 2.2 Legislation 6 2.3 Eligible electors 6 2.4 Strategic context 7 2.5 Approved procedures 7 2.6 iVote usage 7 2.7 Research of elector satisfaction 9 2.8 Inquiries regarding iVote 9 3 Assessment of internet voting 10 3.1 Principles standards and guidelines 10 3.1.1 ECANZ principles 10 3.1.2 Council of Europe recommendations on standards 10 3.1.3 Voluntary voting system guidelines 10 3.2 Transparency 10 3.2.1 Open source software 11 3.3 Scrutiny 11 3.4 Audit and monitoring 11 3.5 Risks and threats 12 3.6 Verifiability 12 3.7 Cryptography 13 4 Strategy and objectives 14 5 Innovations for iVote at the 2019 State election 15 5.1 ECANZ principles and Council of Europe recommendations 18 5.2 Transparency, auditing and scrutiny 18 5.2.1 Transparency 18 5.2.2 iVote source code 18 5.2.3 Auditing and monitoring 19 5.2.4 Scrutiny 19 5.3 Risk management 19 5.4 Verifiability 20 5.4.1 Cast as intended verification 20 5.4.2 Recorded as cast verification 20 5.4.3 Counted as recorded verification 21 5.4.3.1 Pre-mixnet verification 21 5.4.3.2 Mixnet verification 23 NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001 T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 2 of 92
iVote® refresh project for the 2019 NSW State election 5.4.3.3 Decryption verification 23 5.5 Cryptography 23 6 iVote systems 24 6.1 Registration system and credential management 25 6.2 Voting system 25 6.2.1 Election configuration 26 6.2.2 Voting website 27 6.2.3 Telephone voting 27 6.2.4 Close of voting 27 6.2.5 Immutable logs 28 6.3 iVote assurance system 28 6.4 System security and resilience 29 6.5 iVote controls and features 32 7 Using iVote 39 7.1 iVote dates for the 2019 State election 39 7.2 Apply 40 7.3 Vote 41 7.4 Verify 41 7.5 Re-apply 42 7.6 iVote call centre support 42 7.7 Communication and stakeholder engagement 43 8 Appendices 43 8.1 Timelines 43 8.2 JSCEM iVote recommendations 44 8.3 ECANZ principles 45 8.4 ECANZ principles and Council of Europe mapping 48 8.5 iVote mapping to Council of Europe standards 59 8.6 Global trends in electronic voting 73 8.6.1 Switzerland 73 8.6.2 Estonia 73 8.6.3 France 74 8.6.4 Norway 74 8.6.5 Canada 74 8.6.6 Conclusion 74 8.7 Analysis of verification options 75 8.8 List of standards 86 9 Glossary 88 NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001 T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 3 of 92
iVote® refresh project for the 2019 NSW State election Table of figures Figure 1: Uptake of iVote since 2011 8 Figure 2: iVote ecosystem 24 Figure 3: SCYTL voting system – conceptual architecture 26 Figure 4: iVote voting system – opening the ballot box 27 Figure 5: SCYTL voting system – mixnet 28 Figure 6: iVote – security architecture 31 Figure 8: iVote user process 39 Figure 9: iVote election operational timelines 43 Figure 10: NSW State election timeline and iVote system life span 44 NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001 T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 4 of 92
iVote® refresh project for the 2019 NSW State election 1 Summary State legislation enables the NSW Electoral Commission to implement a remote electronic voting system to provide technology-assisted voting to eligible electors. “Electronic voting” uses electronic or computerised equipment to provide part or all of the vote-casting and vote-collection process. The NSW Electoral Commission has developed the iVote®1 system, which is a voting system that enables eligible electors to cast their vote using telephones or computers with browsers and internet access. The iVote voting method is offered, alongside postal and early voting, to improve the enfranchisement of electors who would otherwise not be able to vote independently or have difficulty voting in person at a voting centre on election day. We recognise that remote electronic voting operates in a complex and challenging technical environment that is developing rapidly. For the 2019 State election, we are undertaking a major project to refresh iVote. This project will not only improve the iVote experience for electors, it also leverages recent advances in electronic voting technology and security. The project aims to improve the general useability of iVote, introduce multi-language support and provide a new and improved method for the elector to verify that their vote is cast as they intended. The refresh of iVote will also enhance and improve the overall security of iVote including strengthening the encryption, updating the security of all the iVote infrastructure and improving verifiability across key components of iVote. In addition, we will improve the transparency, auditability and scrutiny of iVote. The iVote refresh project is a major undertaking. We have analysed current and emerging advances in electronic voting as well as engaging with a broad range of experts and academics to ensure iVote remains contemporary. Since the 2015 State election, there have been a number of developments which have influenced the refresh project including the passing of the Electoral Act 2017, the report into the conduct of the 2015 State election by the NSW Parliament’s Joint Standing Committee on Electoral Matters (JSCEM), the report on the security of the iVote system by Roger Wilkins AO, the release of the Electoral Council of Australia and New Zealand (ECANZ) principles for internet voting and the electronic voting recommendations developed by the Council of Europe. 1 iVote®: Registered trade mark of the State of NSW (NSW Electoral Commission). NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001 T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 5 of 92
iVote® refresh project for the 2019 NSW State election
2 Introduction
This document has been prepared by the NSW Electoral Commission to provide information about the iVote
refresh project and what it means for the use of iVote at the NSW State election in March 2019.
2.1 Background
iVote has been offered at:
• the 2011 and 2015 NSW State elections
• 17 NSW State by-elections.
iVote was also trialled at the Western Australian 2017 State election to provide remote voting to
approximately 2,000 electors who are blind or have low vision.
We are committed to continually reviewing and improving iVote to ensure it reflects advances in electronic
voting. We received funding for the 2017-18 and 2018-19 financial years to implement a ‘refreshed’ version
of the iVote system for the 2019 State election. Details of the procurement strategy, along with other project
documentation, are available on the NSW Electoral Commission website 2.
In addition to information about the refresh project, this document also outlines changes made to iVote in
response to recommendations made by the JSCEM in its report on the administration of the 2015 State
election 3 and by Roger Wilkins AO in his report on the security of the iVote system 4.
2.2 Legislation
On 1 July 2018, the Electoral Act 2017 replaced the Parliamentary Electorates and Elections Act 1912 which
governed the conduct of the 2015 State election.
Provisions for technology assisted voting are found in the Electoral Act 2017.
2.3 Eligible electors
An elector is eligible to use technology assisted voting if: 5
• The elector has a disability (within the meaning of the Anti-Discrimination Act 1977) and because of that
disability he or she has difficulty voting in person at a voting centre or is unable to vote without
assistance.
• The elector is illiterate and because of that he or she is unable to vote without assistance.
• The elector’s residence is not within 20 kilometres, by the nearest practicable route, of a voting centre.
• The elector is a silent elector (people who have applied for their address to be kept confidential on the
electoral roll; this is a new category of eligible elector).
• The elector will not throughout the hours of voting on election day be in New South Wales.
2 Details of the 2019 iVote refresh program
http://www.elections.nsw.gov.au/about_us/plans_and_reports/iVote_reports
3 Joint Standing Committee on Electoral Matters, Parliament of New South Wales, Administration of the 2015 NSW election
and related matters, Report 2/56 (November 2016), Recommendations 5, 6, 7, 8 & 9
https://www.parliament.nsw.gov.au/committees/DBAssets/InquiryReport/GovernmentResponse/6091/Govt%20Response
%20-%20Inquiry%20into%20the%202015%20NSW%20State%20Election.pdf
4 Roger Wilkins AO, Report on the Security of the iVote System (May 2018), https://www.elections.nsw.gov.au/About-
us/Public-interest-information/Commissioned-reports/Report-on-the-iVote-system
5 Electoral Act 2017, section 152.
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 6 of 92
iVote® refresh project for the 2019 NSW State election
• The elector is a registered early voter (technology assisted voting)
(this is a new category of eligible elector 6 commencing after the NSW 2019 State election).
• In relation to a by-election, the elector will not throughout the hours of voting on election day be within
the electoral district concerned.
• The elector meets such other eligibility requirements as may be prescribed by the regulations. (Note: no
such regulations have as yet been made).
2.4 Strategic context
The provision of iVote at elections directly supports the NSW Premier's priorities of improving government
services and the State priority for improved government digital services, which aims to significantly increase
the number of government transactions conducted via digital channels by 2019. Further, the NSW digital
government strategy sets the vision and imperative for the whole-of-government transformation to a digital,
responsive and agile public sector. This transformation is built on three priorities:
1. Improving customer experience of government services 7
2. Better policies, services and decisions enabled by data insights
3. Streamlined and simplified government processes.
The iVote refresh project is the second-largest digital project within the Premier and Cabinet cluster 8 and
aligns with priorities 1 and 3 above.
The NSW Electoral Commission strategic vision is to “maintain confidence in the integrity of the democratic
process and make it easy for people to understand and participate”. Technology-assisted voting, using the
iVote channel, is a key element in achieving this vision and directly supports two strategic goals:
1. Customer-focused products and services that deliver seamless end-to-end electoral services.
2. Engagement, influence and advocacy to build reach, impact, influence and collaboration with our key
stakeholders to improve our engagement and delivery.
iVote also aligns with our customer-centred design principles.
2.5 Approved procedures
The Electoral Act 2017 provides that the Electoral Commissioner may approve procedures to facilitate voting
by eligible electors at an election by means of technology-assisted voting. The Commissioner will approve
procedures for the 2019 State election, which will be published on our website 9.
2.6 iVote usage
The table below shows the number of electors who have used iVote at each election event since 2011.
6 Electors will only be able to register as a registered early voters (technology assisted voting) after the 2019 State election
7 https://www.digital.nsw.gov.au/digital-transformation/digital-strategy
88 https://www.digital.nsw.gov.au/cluster/premier-and-cabinet
9 Current iVote Approved Procedures
https://www.elections.nsw.gov.au/voting/iVote/procedures/technology_assisted_voting_approved_procedures_for_nsw_s
tate_elections
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 7 of 92iVote® refresh project for the 2019 NSW State election
Table 1: Votes cast using iVote at NSW State elections and by-elections since 2011
Election event Date District Votes cast % of total
using iVote votes cast
State election Mar 2011 All 93 districts and Legislative Council 46,864 1.1%
By-election Nov 2011 Clarence 1,246 2.8%
By-election Aug 2012 Heffron 798 2.2%
By-election Oct 2012 Sydney 2,192 5.7%
By-election May 2013 Northern Tablelands 1,860 4.2%
By-election Oct 2013 Miranda 679 1.6%
By-election Oct 2014 Newcastle and Charleston 1,600 1.9%
State election Mar 2015 All 93 districts and Legislative Council 283,669 6.2%
By-election Nov 2016 Canterbury, Orange and Wollongong 6,255 4.3%
By-election Apr 2017 Gosford, Manly and North Shore 6,326 4.7%
By-election Oct 2017 Blacktown, Cootamundra and Murray 8,095 5.8%
By-election Sep 2018 Wagga Wagga 2,666 5.5%
Figure 1: Uptake of iVote since 2011
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 8 of 92iVote® refresh project for the 2019 NSW State election
2.7 Research of elector satisfaction
Research conducted following the 2015 State election 10, shows a high degree of satisfaction among electors
who used iVote, with approximately 97 per cent of electors surveyed being satisfied with iVote. Electors
found iVote easy to use and convenient, and the majority stated they would use iVote again.
Importantly, about 10 per cent of these electors stated they couldn’t have voted had iVote not been available.
This indicates that iVote has had a positive impact on elector participation. There has also been continued
support from electors who are blind or have low vision, who could not vote secretly and independently
without iVote.
The research also sought electors’ views regarding any improvements that could be made to iVote.
Feedback related to aspects of the technical experience, awareness of elector’s ability to verify their votes
and general security.
2.8 Inquiries regarding iVote
Following each State election, the JSCEM conducts an inquiry into the administration of the election.
Following its inquiry into the 2015 State election, the JSCEM made a number of recommendations regarding
iVote (see JSCEM iVote recommendations). These recommendations have been considered in the iVote
refresh project.
One recommendation was that the NSW Electoral Commission undertake an inquiry to examine the current
iVote system. Roger Wilkins AO was commissioned to undertake this inquiry with the following terms of
reference:
1. whether the security of the iVote system is appropriate and sufficient
2. whether the transparency and provisions for auditing the iVote system are appropriate
3. whether adequate opportunity for scrutineering of the iVote system is provided to candidates and
political parties
4. what improvements to the iVote system would be appropriate before its use at the 2019 State
election.
The report made 29 recommendations grouped into the following broad categories:
• national approach
• security
• transparency, auditability and scrutiny
• resourcing and governance.
The report and the NSW Electoral Commission’s response to its recommendations have been published on
our website. 11
10https://www.elections.nsw.gov.au/NSWEC/media/NSWEC/Reports/Election%20reports/IPSOS-report-for-the-state-
election-2015-(PDF-3.4MB).pdf
11 Roger Wilkins AO, Report on the Security of the iVote System (May 2018), https://www.elections.nsw.gov.au/About-
us/Public-interest-information/Commissioned-reports/Report-on-the-iVote-system
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 9 of 92iVote® refresh project for the 2019 NSW State election
3 Assessment of internet voting
The NSW Electoral Commission is committed to continually improving and enhancing iVote to ensure it
remains a contemporary electronic voting system. This section details the key areas that have been
evaluated and have influenced the approach taken in the iVote refresh project.
3.1 Principles standards and guidelines
In the past there have been few agreed principles or standards that can be applied to the field of Internet
voting. Principles for an Australian internet voting system were endorsed by ECANZ in 2017. The Council of
Europe has developed and released a set of recommendations on standards in the field of electronic voting 12
and the National Institute of Standards and Technology (NIST) and the US Election Assistance Commission
(EAC) have published an update to their Voluntary Voting System Guidelines (VVSG). There are also
numerous standards, guidelines and principles that cover the broad areas of security, cryptography and
secure software development which are listed at 8.8.
3.1.1 ECANZ principles
In July 2017, ECANZ endorsed 11 key principles for an Australian internet voting system. In developing
these principles, ECANZ examined the VVSG and the Council of Europe’s intergovernmental
recommendations for electronic voting. These principles, which have been established to guide the design
and implementation of an internet voting service in Australia, are grouped into the three domains of
enfranchisement, integrity and privacy, detailed in 8.3 ECANZ principles.
3.1.2 Council of Europe recommendations on standards
The Council of Europe has been the only organisation that has set intergovernmental standards in the field
of electronic voting. In 2004 the Council of Europe first released the recommendation on legal, operational
and technical standards for electronic voting and in 2017 the Council of Europe released its updated
recommendations 13. These recommendations have been mapped to the ECANZ principles to provide a
framework for iVote, not only for the 2019 State election, but also in its future direction. 8.4 ECANZ principles
and Council of Europe mapping provides details of these mappings.
3.1.3 Voluntary voting system guidelines
The US Assistance Commission has developed and released the VVSG to provide a set of specifications
and requirements against which voting systems can be tested to determine if they provide the basic
functionality, accessibility and security capabilities required to ensure the integrity of voting systems. While
VVSG is primarily intended for the use of electronic voting machines they provide a useful set of guidelines
for the general operation of any form of electronic voting. 14
3.2 Transparency
• Providing transparency in all phases of an election establishes and maintains public trust and confidence
in the electoral process. In paper-based voting, many aspects of the election are observable and well
understood. Electronic voting challenges the traditional approach to transparency as many of the
observable steps in paper voting channels are automated and processed within computer systems and
cannot be observed or scrutinised in the same manner. Transparency is one of the ECANZ-endorsed
voting principles and the Council of Europe list five recommended standards grouped as Transparency
and Observation:
12 Council of Europe recommended standards for electronic voting
https://www.coe.int/en/web/electoral-assistance/e-voting
https://search.coe.int/cm/Pages/result_details.aspx?ObjectId=0900001680726f6f
13 Council of Europe standards for electronic voting
https://www.coe.int/en/web/electoral-assistance/e-voting
14 https://collaborate.nist.gov/voting/bin/view/Voting/VVSGPrinciplesAndGuidelines
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 10 of 92iVote® refresh project for the 2019 NSW State election
• Standard 31. Member States shall be transparent in all aspects of e-voting.
• Standard 32. The public, in particular voters, shall be informed, well in advance of the start of voting, in
clear and simple language, about:
• any steps a voter may have to take in order to participate and vote
• the correct use and functioning of an e-voting system
• the e-voting timetable, including all stages.
• Standard 33. The components of the e-voting system shall be disclosed for verification and certification
purposes.
• Standard 34. Any observer, to the extent permitted by law, shall be enabled to observe and comment on
the e-elections, including the compilation of the results.
• Standard 35. Open standards shall be used to enable various technical components or services,
possibly derived from a variety of sources, to inter-operate.
3.2.1 Open source software
Open-source software is a type of computer software where source code is released under a license in
which the copyright holder grants users the rights to study, change, and distribute the software to anyone
and for any purpose.
While there are examples of open source electronic voting projects, none of them are currently suitable for
technology-assisted voting at elections in New South Wales.
Often confused with open source software is public access to software source code for review. Public access
to electronic voting software source code helps to build public confidence as anyone is able to inspect the
source code and assure themselves of its correct operation. We believe this approach has merit as part of
election transparency and the key elements of the iVote system source code will be made available for public
scrutiny. (See 5.2.2 iVote source code.)
3.3 Scrutiny
An important part of transparent elections is the ability for candidates and political parties to scrutinise key
election processes and to observe the overall operation of the election and tallying of results. A similar level
of scrutiny of electronic voting can be achieved by allowing scrutineers to observe key events and processes
of electronic voting as well as the final decryption and tallying of results.
3.4 Audit and monitoring
The NSW Electoral Commission is required to engage an independent auditor to conduct audits of the use
and operation of iVote. 15
The increasing use of electronic voting has been recognised by the international electoral observation
community as one of the paramount challenges facing election observation as there is relatively little
experience observing electronic voting. The Carter Center 16 has developed a methodology for observing
electronic voting 17 as well as a handbook on observing electronic voting 18
15 Electoral Act 2017, section 156.
16 https://www.cartercenter.org/
17 https://www.cartercenter.org/documents/elec_voting_oct11_07.pdf
18 https://www.cartercenter.org/resources/pdfs/peace/democracy/des/carter-center-e_voting-handbook.pdf
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 11 of 92iVote® refresh project for the 2019 NSW State election
Alongside external audits, all electronic voting systems must maintain and collate a centralised and
immutable 19 regime of logs on every aspect of the voting process. These logs and the monitoring systems
need to provide up to date information on the health of the electronic voting systems as well as evidence of
tampering making it more difficult for attackers to hide in the event of a system being compromised. These
logs may also have to provide evidence in the case of legal challenges or disputes.
3.5 Risks and threats
All electronic voting systems must be resilient and protected against threats that can undermine public
confidence in the conduct of the election or, in the worst case, render all votes cast over the channel as
invalid. The threats can be broadly categorised as follows:
• Loss or corruption of information. As with all online services, electronic voting systems need to be
protected from accidental or malicious loss or modification of data. There are many aspects to threats of
this nature and online electronic voting systems need to protect against attempts to “hack” into the
systems, software bugs and sophisticated attempts to intercept and change voting data between the
elector’s device and the election servers. Mitigation of such threats has the added complexity of
maintaining the secrecy of the vote while still providing assurance to electors and other stakeholders of
the integrity of votes taken and counted using online electronic voting systems.
• The electronic voting systems need to be available throughout the voting period. All the systems and
networks need to be planned and designed in such a way that they are resilient and protected against
faults in the hardware or networks as well as having sufficient capacity to handle the expected demand.
The systems and networks will also have to be protected against attempts to disrupt the service using
denial of service attacks.
• As with all channels of voting, online electronic voting systems need to have a mechanism to correctly
authenticate and identify the elector. While online voting systems can provide levels of identification that
are comparable to, if not stronger than, similar paper voting channels (eg postal voting) there have to be
protections against attempts to undertake mass impersonation of electors. This could range from
attempts to steal elector’s passwords to guessing electors’ enrolment details.
• As with postal voting, the act of voting online is not supervised, which means that the elector could be
subjected to forms of coercion when casting their vote. Research 20 has shown that in Australia there is
limited evidence of interference in voting and that online voting is unlikely to lead to an increase in
coercion. Nevertheless, online systems need to provide protection against the possibility of voter
coercion.
3.6 Verifiability
While not available for voting using paper ballots, verifiability is an important property for electronic voting
and various electronic voting protocols take different approaches to the fundamental goal of assuring
integrity. Verification is typically considered in three parts:
1. Cast as intended - the elector’s preferences are cast as they intended
2. Recorded as cast - the system has actually saved and stored the elector’s preferences correctly
3. Counted as recorded - the saved preferences are all counted correctly.
19 It is noted that absolute protection is generally unattainable, the need for immutable logs reflects the ideal strength of
the log protection
20 Internet Voting and Voter Interference - A report prepared for the New South Wales Electoral Commission by Associate
Professor Rodney Smith, Department of Government and International Relations, University of Sydney
https://www.elections.nsw.gov.au/NSWEC/media/NSWEC/Reports/Commissioned%20reports/Internet-voting-and-voter-
interference-report-2013-(PDF-437kB).pdf
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 12 of 92iVote® refresh project for the 2019 NSW State election
The first two are performed by the elector, the third should be open to scrutiny by political participants.
Voting protocols and verification options need to strike an appropriate balance amongst three requirements:
1. Proof against vote tampering
2. Secrecy of the vote
3. Usability and accessibility for the elector.
We have analysed the different verification schemes and how they could apply to iVote, see 8.7 for details of
this analysis.
Verification provides electors with confidence that their vote has been cast and counted as they intended. It
is also used as part of the overall assurance that the iVote channel is operating correctly. Our aim is to
provide a verification approach that is useable for electors and available immediately after voting, rather than
requiring the elector to undertake verification as a separate step to casting their vote.
3.7 Cryptography
Cryptography is at the core of the iVote system and is essential to ensure votes remain secret and unable to
be tampered with. We require that all cryptographic schemes are implemented using published, credible and
appropriate cryptographic algorithms based on relevant NIST standards 21 and Federal Information
Processing Standards (FIPS) 22. In particular NIST recommends that all new systems deployed until 2030
need to have cryptographic algorithms and schemes with a security strength equivalent to at least 112 bits
(strength is based on key length and the algorithm used) 23.
There is ongoing research into quantum computing that could impact cryptography used in iVote. An
adversary with access to a hypothetical quantum computer in the future, could break most of the popular
public-key algorithms of today. We will continue to monitor this field with a view to the 2023 State election.
21 https://csrc.nist.gov/publications/sp800
22 https://www.nist.gov/itl/current-fips
23 https://csrc.nist.gov/publications/detail/sp/800-131a/rev-1/final
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 13 of 92iVote® refresh project for the 2019 NSW State election
4 Strategy and objectives
Strategy Objective Activity
1.1 Make available in Broaden access to users 1.1.1 New voting system to include six additional
key community with significant needs languages based on population need
languages
1.2 Improve navigation Make it easier for people to 1.2.1 Linking iVote system to simplified navigation on our
to iVote find out about iVote and to website
access it
1.2.2 Communications campaigns
1.3 Maintain or improve Ensure that iVote is 1.3.1 Consultation with our reference groups (Disability,
the accessibility of iVote accessible to all eligible Multicultural and Aboriginal)
NSW electors
1.3.2 Undertake testing with key user groups
1.3.3 Accessibility testing
1.4 Publish easy-read Build user confidence in 1.4.1 Promote the security and assurance features of
information for users iVote, including system iVote
security and online safety 1.4.2 Provide links to online safety information
https://www.staysmartonline.gov.au/
2.1 Introduce end-to-end Transparency and 2.1.1 iVote to provide three key types of verification
verification assurance of the process
(i) “Cast as intended” – votes submitted match electors’
intentions
(ii) “Recorded as cast” – verify that iVote has received
and saved their votes as cast
(iii) “Counted as recorded” – The proofs and traceability
that link the votes cast to those included into the count
2.2 Increase the rate of A significant growth in the 2.2.1 The new smartphone app for verification via a QR
voter verification by rate of voters verifying will code displayed at the end of voting should prove easier
making it easier give a high level of statistical for most voters
assurance.
2.3 Improve To increase the publically 2.3.1 Publish transparency document outlining all
transparency available information on other documents and data to be made available
iVote and the opportunities
for scrutineers to observe
the processes.
3.1 Credentials Improve the strength of the 3.1.1 Require electors who select to cast vote using
elector’s credentials to iVote voting website to create a password of sufficient
protect against potential strength to resist “cracking”
“cracking”
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 14 of 92iVote® refresh project for the 2019 NSW State election
Strategy Objective Activity
3.1.2 Require electors who select to cast vote using
iVote telephone voting system to create a 10 digit PIN
3.2 Enhance data centre Secure data centre hosting 3.2.1 New Voting System hosting will be in IRAP certified
security is a key element of iVote datacentre with ASD certified PROTECTED cloud and
security ASD certified PROTECTED gateway
3.2.2 Updated Registration System hosting will be in
NSW GovDC (previously NSW Electoral Commission
internally hosted)
5 Innovations for iVote at the 2019 State election
The iVote refresh project includes major enhancements to the voting and verification modules, enhanced
system security, improved transparency as well as improvements to the scrutiny, audit and monitoring
mechanisms. There are also improvements to the websites used by the electors including the provision of
the iVote voting website in a number of languages other than English.
Pre-2019 iVote 2019
Verification
• Electors had to use the iVote telephone • Electors who vote by the iVote website can verify as soon
verification system requiring a six-digit as they cast their vote using the iVote verification app on
PIN, eight-digit iVote number and 12-digit their smartphone, making the verification much simpler and
iVote receipt using the telephone keypad more immediate
• People using iVote from overseas might • Since the iVote verification app runs on a smartphone it
incur international call costs to verify provides greater assurance to the elector that their vote
hasn’t been corrupted by “malware” on their PC or laptop
• Those electors who cast their vote by the iVote telephone
voting system will still have to use the iVote telephone
verification system but will only have to enter their 10-digit
PIN and 8-digit iVote number making the process easier
• All voters get a receipt number as proof • All voters will receive a receipt
that iVote had received their vote.
• All receipts will be available for checking during the voting
• The receipts were only available for period as well as after the election
checking after the election
• Provides voters a method to assure themselves that iVote
has received and retains their vote
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 15 of 92iVote® refresh project for the 2019 NSW State election
Pre-2019 iVote 2019
• Limited number of voters verified their • Easier and more immediate verification is expected to
votes result in more voters verifying, improving assurance and
confidence in the operation of iVote
• Proofs of correct decryption emitted as • Improved verification of the vote decryption by generating
part of the ballot box opening and vote mathematical proof that the decryption has completed
decryption correctly and has not corrupted the votes in any way
• Introduction of a verifiable mixnet that generates
mathematical proof that the mixing of encrypted votes (for
vote privacy) has completed correctly and has not
corrupted the votes in any way
Improved transparency
• The key components of the iVote core • Expand the range of iVote information and documents to
voting system were reviewed by be published pre and post election – this will be detailed in
independent reviewers a separate document on transparency for iVote
• Published reports for the 2015 State • Use a Technical Advisory Group to review and comment
election (available at on technical aspects in the design, development and
http://www.elections.nsw.gov.au/about_u throughout the election.
s/plans_and_reports/ivote_reports)
• Expand the role of the independent auditor to cover a
• Engaged independent auditors to broader range of iVote operations. Publish the audit and
monitor, observe and report on key iVote control plan and the post election report
operations
• Publish day to day iVote operational information
• Independent expert panel appointed to
review iVote as per JSCEM 24 • iVote voting system source code available for review pre-
recommendation – report publicly election by application under Deed of confidentiality
released in November 2018
• Key components of the iVote voting system source code
will be available post-election for inspection and comment
• An independent expert panel will be created to monitor,
advise and report on iVote use at each major election
Improved scrutiny
• Scrutineers were invited to observe the • The NSW Electoral Commission will offer training to
iVote ceremony at the close of the scrutineers to ensure they better understand the iVote
election to observe the “unsealing” of the system. The training will also provide information on the
iVote ballot box where the votes are data to be published and how this can be used to scrutinise
decrypted and checked for entry into the the operations of iVote.
count
• Scrutineers will be able to observe more iVote processes,
including the “sealing” of the ballot box where the iVote
system undergoes a “lockdown” process and testing is
24 NSW Parliament’s Joint Standing Committee on Electoral Matters
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 16 of 92iVote® refresh project for the 2019 NSW State election
Pre-2019 iVote 2019
conducted to confirm that test votes correctly pass through
the system
• Scrutineers will be able to observe the “unsealing” of iVote
at the close of voting, with additional proofs of mixing and
decryption of the votes prior to entering the count
• Scrutineers (and the public) will be able to access the iVote
data that is provided on the NSW Electoral Commission
website
Improvements in cryptography
• iVote used SHA1 to “hash” elector’s • SHA256 now used to create electors credential hash as
credentials SHA1 no longer considered appropriate
• 6-digit PIN is used by all electors to log • Electors who select to use the iVote website to vote will
into iVote have to create a password rather than 6-digit PIN
• Passwords will be of a strength that should require at least
three months to break with a brute-force attack.
• Electors who select the iVote telephone voting system will
have to create a 10-digit PIN. Whilst not as strong as the
web based password, this is harder to crack than the 6-
digit PIN, whilst still useable, and appropriate for telephone
voting.
Improved user experience
• No support for community languages • The iVote voting website will be available in English and 6
other languages
• No easy access to How to Vote Cards
• Electors will be able to access How to Vote information
• Optional secondary identification from candidates and parties
accepted Australian passport or driver
licence • Improvements will be made to the iVote application website
to aid useability
• Medicare card can now also be used as a secondary
source of identification
Applying the latest standards and guidelines
• Council of Europe Recommendation • 11 Key Principles for an Australian Internet Voting System
Rec(2004)11 on legal, operational and developed by ECANZ
technical standards for e-voting were
covered in the Security Implementation • Updated to Council of Europe Recommendation
Statement for 2015 CM/Rec(2017)5
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 17 of 92iVote® refresh project for the 2019 NSW State election
Pre-2019 iVote 2019
• New Voluntary Voting System Guidelines (VVSG 2.0) from
National Institute of Standards and Technology (USA) and
the US Election Assistance Commission
5.1 ECANZ principles and Council of Europe recommendations
Section 8.4 provides a traceability matrix showing the alignment of the Council of Europe recommendations
to the 11 ECANZ Principles and section 8.5 iVote mapping to Council of Europe standards details how iVote
address each of the 49 Council of Europe recommendations. This framework provides the NSW Electoral
Commission with assurance that iVote is conforming to a set of recognised recommendations.
5.2 Transparency, auditing and scrutiny
The provision of transparency, scrutiny and auditing of the iVote channel are interlinked and are intended to
provide mechanisms to assure all stakeholders that the iVote channel is operating correctly. It is important to
note that the NSW Electoral Commission does not consider any one of these aspects of iVote in isolation but
will be developing and delivering each one in a manner that builds a strong picture of the correct operation of
iVote.
5.2.1 Transparency
As noted earlier, electronic voting challenges the traditional approach to electoral transparency. iVote for the
2019 State General Election will have a significant number of transparency improvements over previous
versions
During the 2019 State election the NSW Electoral Commission will publish key data to provide insight into
the progress and functioning of the iVote channel. One important area of improvement is the verifiability
features now available and key verification data will also be published alongside other iVote data. As well as
publication of the verification data, we will publish the results of the mixnet processing as well as the
preferences loaded into the NSW Electoral Commission’s Proportional Representation Computer Count
(PRCC) system after the election.
The NSW Electoral Commission will publish information on the design and operation of the iVote channel in
the public domain. There may be some elements that can’t be published either due to commercial
restrictions or because the level of detail in itself may pose a risk to the overall security of the iVote systems.
The NSW Electoral Commission will use the services of its Technical Advisory Group to review and comment
on technical aspects of the iVote system.
5.2.2 iVote source code
The NSW Electoral Commission will make the iVote voting system source code available for review and it
will be published under the following conditions:
• From January 2019 all the iVote voting system software supplied by Scytl will be available for review, by
application, under deed of confidentiality.
• As previously, the NSW Electoral Commission will engage selected experts to independently review the
iVote system source code. We will also proactively encourage other experts to review the source code
under deed of confidentiality.
• After the election the NSW Electoral Commission will release certain components of the Scytl Voting
System. The components listed below, will be available for review and comment:
• voting client (JavaScript)
• verification application (mobile app)
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 18 of 92iVote® refresh project for the 2019 NSW State election
• voting service
o validation of the encrypted vote
o validation of the cryptographic proofs
o digital signature of the receipt
• verification service
o validation of the encrypted vote
o validation of the cryptographic proofs
• counting service
o vote decryption
o digital signature
5.2.3 Auditing and monitoring
For the 2015 State election, the scope of the mandatory independent audit of the use of iVote was:
• assess the processes and controls used to secure access to iVote before the commencement of voting
• assess the NSW Electoral Commission processes for testing the logic and accuracy of the iVote system
prior to the commencement of iVote voting
• assess the processes and controls used for the voting decryption ceremony once the election has ended
• review relevant reports created by third parties.
For the 2019 State election the scope and role of the auditor will be expanded to enhance the overall
transparency mechanisms. There will be an iVote audit plan that will aim to cover all aspects of the operation
of iVote including the performance of the key controls. In addition, the NSW Electoral Commission will
engage an expert advisory panel to report on key elements of the use of iVote during the election.
5.2.4 Scrutiny
Scrutineers provide an important role in the overall transparency of an election as they are able to observe
and report on key electoral processes as representatives of candidates. The role of the scrutineer is equally
as important for the iVote channel. The NSW Electoral Commission will provide scrutineers with access to
the key iVote events, including the testing and locking down of the electronic voting ballot box prior to start of
voting and the decryption of the ballot box at the end of voting. We will also provide training to scrutineers to
enhance their observation and understanding of the iVote logic and accuracy testing, the lockdown and the
decryption process. Scrutineers will be provided transparency and audit information and will also be able to
access the iVote data published during the election.
5.3 Risk management
The NSW Electoral Commission’s risk appetite statement outlines the amount of risk we are prepared to
accept to achieve our strategic and operational objectives. We face a range of risks and overall, we have a
low risk appetite. This means we look to avoid risks and uncertainty and have a preference for options that
have a low degree of inherent risk. We do accept there is a certain level of inherent risk in our activities and
acknowledge that a certain level of risk helps us develop and innovate to better serve our stakeholders and
clients. iVote is an example of our innovation in service delivery.
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 19 of 92iVote® refresh project for the 2019 NSW State election
We conduct extensive risk modelling and analysis on all aspects of iVote and ensure that controls and
mitigations are in place. We recognise that, as with all of our voting options, it is not possible to completely
mitigate all risks to iVote.
5.4 Verifiability
Section 3.6 details the forms of verification that need to be in place in order for electors to be assured their
vote is not only cast but also counted as they intended. The iVote channel has undergone a significant
improvement in the forms of verifiability offered to electors and other interested stakeholders as detailed
below.
5.4.1 Cast as intended verification
“Cast as intended” confirms the elector’s submitted vote matches their intentions. This can be achieved with
a sensible user interface and the ability to confirm preferences before submitting.
The iVote system provides a voting website designed to ensure an elector casts valid Legislative Assembly
and Legislative Council votes in accordance with the relevant directions. Electors are allowed to cast a blank
ballot paper if they wish, although receive a warning before submitting the vote. After completing both ballot
papers, the elector is presented with their preferences for review and optionally changing prior to submitting
to the iVote voting system.
On successful submission and storage of the elector’s vote, the iVote system generates and returns to the
elector a receipt. The iVote receipt is a signed hash of the encrypted vote and provides the elector with a
“digital fingerprint” of their vote. The iVote receipt can be used by electors to verify that their vote is
unchanged. Electors will be able to check their receipt on the iVote receipt portal once their vote has been
cast. This provides the elector with the ability to check at any time that their vote has been received and is
securely held in the iVote system.
5.4.2 Recorded as cast verification
“Recorded as cast” provides the elector with assurance that the NSW Electoral Commission has received
and saved their vote as cast. The iVote system provides an improved “Recorded as cast” verification for
electors. Electors who cast their vote using the iVote website will be able to verify that their votes have been
received and the preferences are recorded as they intended by using the iVote Verification Application,
which they will have to download onto their smartphone. Once the elector submits their vote they will be
presented with a QR code on their web browser that they can scan using the iVote Verification Application.
The elector will then have to enter their iVote number and password into the iVote Verification Application to
complete the verification process. The iVote Verification Application requests the encrypted vote from the
iVote voting system. The encrypted vote is retrieved and forwarded to the iVote Verification Application on
the smartphone. The iVote Verification Application uses the elector’s iVote number and password with the
verification data embedded in the QR code to decrypt the vote on the smartphone and display the elector’s
vote.
Electors who cast their vote using the iVote telephone voting service can verify their vote by calling the iVote
telephone verification service. The elector will have to enter their iVote number and PIN, which is then used
by the iVote telephone verification service to decrypt the elector’s vote and repeat the vote details back to
them over the telephone.
This approach provides a number of key assurances not only to the individual elector but also the NSW
Electoral Commission:
• requiring the elector to verify their vote on a device separate from the one on which they cast their vote
will reduce the possibility of the vote being corrupted by malware on the device used to cast the vote
• assure the elector that the vote has been received and stored correctly by iVote
• for those who have voted using the iVote voting website the provision of the QR code immediately after
submitting their vote increases the likelihood the elector will verify their vote
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 20 of 92iVote® refresh project for the 2019 NSW State election
• this approach is intended to increase the overall assurance to the NSW Electoral Commission that iVote
is operating correctly and increase overall confidence in the integrity of the iVote channel.
5.4.3 Counted as recorded verification
“Counted as recorded” provides the traceability and proof that link the votes saved to the count.
For the 2019 State election, iVote will improve the ability to verify, prove and trace that the votes are correctly
anonymised, decrypted and included in the overall count. After the close of voting there are a number of
important steps in downloading the votes held in the iVote voting system for inclusion in the count. Each step
provides proof and traceability that only valid votes are included into the count and that the votes have been
securely stored and remain as cast by the elector. The steps are:
• Prior to the mixing and anonymising of the votes there are a series of cross-checks between the various
iVote systems to ensure the votes cast can be reconciled between the number of iVote applications and
the votes cast.
• The electronic ballot box is cleansed and validated to ensure only valid votes are passed to the mixing
and decryption processes.
• The valid votes are mixed to ensure that there are no links between the votes cast and the elector and
the results of the process are passed to the decryption process.
• The votes are decrypted.
• The decrypted votes are then loaded into the NSW Electoral Commission systems for the tallying and
counting of the iVote votes alongside votes cast through other channels.
Details of the three steps of cross-checking credentials, reconciling receipts and cleansing the ballot box are
provided below.
5.4.3.1 Pre-mixnet verification
The NSW Electoral Commission will undertake a series of checks and reconciliations prior to the mixnet that
ensures that only eligible electors have cast votes and that only the valid votes are passed to the mixnet and
decryption process. These checks will be undertaken as part of the decryption ceremony at which
scrutineers and auditors will be present.
Cross checks between credential management and iVote voting systems
The NSW Electoral Commission will undertake a cross check between the credential management system
and the iVote voting system. The credential management system ensures that only eligible electors can
apply for iVote as well as handling the electors’ credentials, while the iVote voting system holds the votes
cast by the eligible electors. The two systems maintain a common identifier called VoterKeysID. Using this
common identifier, we undertake the following cross checks:
• reconcile that for each VoterKeysID held in the credential management system there is a corresponding
ID in the iVote voting system
• for each VoterkeysID in the credential management system, the Legislative Assembly district linked to
that ID is the same as the corresponding ID in the iVote voting system
• for each VoterkeysID in the credential management system, the status of the vote (valid or not valid 25) is
the same as the corresponding ID in the iVote voting system.
25A vote in iVote is marked not valid if the elector has applied for more than one iVote, in which case the last vote cast in
iVote is considered valid
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 21 of 92iVote® refresh project for the 2019 NSW State election
The checks provide the following evidence:
• only eligible electors have cast a vote using iVote
• there is only one vote in the iVote voting system for each application
• there is no evidence of votes having been inserted into the iVote voting system for which there is no
linked elector
• the validity of the votes held in the iVote voting system has not been changed
• the Legislative Assembly districts of the votes held in the iVote voting system have not been changed.
It is important to note that once the cross checks have been completed that all the VoterKeysIDs in the
credential management system will be irrecoverably deleted ensuring that the links cannot be reconstructed
at any time in the future.
Reconciliation of iVote receipts
The next step is to compare receipts for each vote cast and held by the iVote voting system against the
receipts held by the iVote assurance system. When the elector submits their vote they receive a receipt
which is a digital “fingerprint” of the encrypted vote stored in the iVote voting system. At the same time, the
receipt is copied into the iVote assurance system. The elector checks the existence of their receipt against
the copy held by the iVote assurance system.
The receipts in both the iVote voting and assurance systems can be cross checked and compared to ensure
that the receipts in both systems are the same.
The checks provides the following evidence:
• votes haven’t been added to the iVote voting system without generating a valid receipt
• since electors check their receipts against the iVote assurance system, and the iVote voting and
assurance systems match, the iVote voting system has been storing and handling the votes correctly.
Ballot box cleansing
Only valid votes can pass on to the decryption process. Ballot box cleansing ensures the checks below are
undertaken on all votes held by the iVote voting system:
• The NSW Electoral Commission’s Election Management Application (EMA) provides a list of electors
who have cast a vote through iVote as well as another voting channel 26. This is passed to the cleansing
process and the votes in iVote for these electors are all marked as not valid.
• The cleansing process checks that there is only one vote for each elector.
• The cleansing process also validates the integrity of each vote inside the ballot box by checking the
following attributes:
• the authentication token of the vote
• the chain of the x.509 certificate used to sign the vote is valid
• the different aspects of the cryptography forming the vote.
26 postal vote or early vote
NSW Electoral Commission | GPO Box 4046 Sydney NSW 2001
T 1300 022 011 | F 02 9290 5410 | E policycoordinator@elections.nsw.gov.au | elections.nsw.gov.au Page 22 of 92You can also read
